CVE-2026-67577: Gitea restricted-user activity and heatmap disclosure
Gitea's activity-feed and contribution-heatmap API handlers do not apply the profile visibility check for restricted accounts viewing Limited-visibility users. A restricted user can retrieve activity records and contribution timestamps that the corresponding profile routes deny. Exposed activity can include repository names, commit messages, and issue or pull request events associated with qualifying public-repository activity.
Affected Software
Event History
Frequently Asked Questions
Which users can access the information?
A restricted user can retrieve information associated with a Limited-visibility user. The issue applies to the activity-feed and contribution-heatmap API handlers.
What information may be exposed?
Exposed activity may include repository names, commit messages, and issue or pull request events. Contribution timestamps can also be retrieved through the heatmap API.
Does denying access to the target user's profile prevent this disclosure?
No. The corresponding profile routes deny access, but the affected API handlers do not apply the same profile visibility check.